The correct answer is a brute-force attack. This is because the log entry reveals repeated failed authentication attempts from a single source IP address, 10.10.10.10, targeting multiple usernames like admin, root, and test within a very short time window—a classic pattern of systematically trying different credential combinations against a system. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your ability to distinguish between a brute-force attack and password spraying; the key differentiator is that brute-force attacks hammer one source IP against many usernames, while password spraying uses one common password across many accounts. A common trap is confusing this with a dictionary attack, but the log shows attempts across usernames, not just passwords. Remember the memory tip: brute-force is a "broad net" from one IP, while password spraying is a "single key" tried on many locks.
ISC2 CC Security Operations Practice Question
This CC practice question tests your understanding of security operations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
```
[Windows Security Log]
Event ID 4625: An account failed to log on.
Account Name: jdoe
Source Network Address: 192.168.1.100
Failure Reason: Unknown user name or bad password.
Count: 15 occurrences in 5 minutes.
```
Refer to the exhibit. A security analyst reviews this log entry. What type of attack is most likely occurring?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Refer to the exhibit.
```
[Windows Security Log]
Event ID 4625: An account failed to log on.
Account Name: jdoe
Source Network Address: 192.168.1.100
Failure Reason: Unknown user name or bad password.
Count: 15 occurrences in 5 minutes.
```
A
Pass-the-hash attack
Why wrong: Pass-the-hash uses NTLM hashes, not multiple failed logins.
B
Brute-force attack
Repeated failed attempts on the same account indicate brute-force.
C
Password spraying attack
Why wrong: Password spraying targets many accounts with one password; this targets one account.
D
Kerberos ticket attack
Why wrong: Kerberos attacks involve ticket manipulation, not login failures.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Brute-force attack
The log entry shows repeated failed authentication attempts from a single source IP (10.10.10.10) against multiple usernames (admin, root, test) in a short time window. This pattern of systematically trying different credentials against a target system is characteristic of a brute-force attack, where an attacker iterates through possible username/password combinations to gain unauthorized access.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Pass-the-hash attack
Why it's wrong here
Pass-the-hash uses NTLM hashes, not multiple failed logins.
✓
Brute-force attack
Why this is correct
Repeated failed attempts on the same account indicate brute-force.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Password spraying attack
Why it's wrong here
Password spraying targets many accounts with one password; this targets one account.
✗
Kerberos ticket attack
Why it's wrong here
Kerberos attacks involve ticket manipulation, not login failures.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between brute-force and password spraying attacks, where the trap is that candidates confuse the target pattern—brute-force focuses on a single user with many passwords, while password spraying uses one password across many users.
Detailed technical explanation
How to think about this question
In a brute-force attack, the attacker typically uses automated tools like Hydra or Medusa to send repeated authentication requests, often targeting services such as SSH (port 22), RDP (port 3389), or HTTP login forms. The log entry likely shows failed Event ID 4625 (Windows) or auth.log entries (Linux), with a high frequency of 'Logon Failure' events from the same source IP, which is a key indicator for intrusion detection systems (IDS) to trigger alerts. Real-world scenarios often involve rate-limiting or account lockout policies to mitigate such attacks, but attackers may use distributed sources to bypass these controls.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Brute-force attack — The log entry shows repeated failed authentication attempts from a single source IP (10.10.10.10) against multiple usernames (admin, root, test) in a short time window. This pattern of systematically trying different credentials against a target system is characteristic of a brute-force attack, where an attacker iterates through possible username/password combinations to gain unauthorized access.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is reviewing event logs and notices multiple failed login attempts from a single IP address followed by a successful login. Which TWO actions should the analyst take next?
easy
A.Disable the user account immediately.
✓ B.Escalate to the incident response team.
✓ C.Investigate the source IP address for malicious activity.
D.Block the IP address at the firewall.
E.Reset the password for the affected account.
Why B: Options B and E are correct. Investigating the source IP and escalating to the incident response team are appropriate first steps. Disabling the account or resetting the password may be necessary later but should be done after investigation. Blocking the IP may be done but escalation is more critical.
Variation 2. Refer to the exhibit. A security analyst sees these logs from a Linux server. Which security control should the analyst recommend to address this pattern?
medium
A.Enable account lockout after 5 failed attempts.
B.Disable root login via SSH.
C.Block the IP address 192.168.1.100 via firewall.
✓ D.Implement two-factor authentication for SSH access.
Why D: The logs show repeated failed SSH login attempts from a single IP (192.168.1.100) targeting the root account, which is a classic brute-force attack pattern. Two-factor authentication (2FA) for SSH access is the most effective control because it adds a second authentication factor (e.g., TOTP or hardware token) that an attacker cannot bypass even if they guess the password, thus neutralizing the brute-force attack regardless of the number of attempts or the account targeted.
Variation 3. Refer to the exhibit. An analyst sees these logs. What type of attack is occurring?
medium
A.Phishing
B.SQL injection
✓ C.Brute-force attack
D.Port scan
Why C: Option A is correct because repeated failed login attempts from the same IP indicate a brute-force attack. The other options do not match the pattern.
Last reviewed: Jun 30, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.